MC
Product
Mediawiki - Cargo extension
11
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 0Medium 7Low 2
Watch
Add Mediawiki - Cargo extension to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-14363 | 9.8 | Jul 1 | Cargo Extension: SQLi in Special:Drilldown Affected: before 1.43.9,1.44.6,1.45.4 |
| CVE-2026-58521 | 9.8 | Jul 1 | SQLi in Cargo extension via year range filter Affected: before 1.43.9,1.44.6,1.45.4 |
| CVE-2026-96878 | 6.9 | Sep 25 | Cargo Exhibit field alias allows stored XSS Affected: through 3.9.4 |
| CVE-2026-96877 | 6.9 | Sep 25 | Reflected XSS through Cargo Drilldown full-text search Affected: through 3.9.4 |
| CVE-2026-96876 | 6.9 | Sep 25 | Anonymous reflected XSS in CargoExport invalid-alias errors Affected: through 3.9.4 |
| CVE-2026-96875 | 6.9 | Sep 25 | Reflected XSS in Cargo Drilldown hierarchy filters Affected: through 3.9.4 |
| CVE-2025-62671 | 6.9 | Oct 18 | Stored XSS through wikitext in Cargo Affected: master |
| CVE-2026-103049 | 6.1 | Sep 29 | XSS in Cargo's Special:CargoQuery page due to unsanitized table headers Affected: before 1.46.1 |
| CVE-2026-58519 | 5.4 | Jul 1 | Stored XSS through Cargo's map format Affected: before 3.9.1 |
| CVE-2026-96874 | 2.3 | Sep 25 | Stored XSS in Cargo Drilldown tab names Affected: through 3.9.4 |
| CVE-2025-62655 | 2.1 | Oct 17 | SQL injection in Cargo via Special:CargoExport Affected: 1.39; 1.43; 1.44 |
Showing 11